its not an ssh,he was playing eac i guess,and eac writes these commands to detect metori on the server.
I know it due to the knowledge of who implemented the commands into metori and due to playing on eac in 99% cases